Welcome back.
Let's talk about another big vulnerability in Web applications that involves databases, and that is
called Ezekial Injection.
So we already talked about how this works.
So you find a user input on a website that communicates with the database.
Usually those inputs are something like user names or passwords or a page where you're searching for
some type of a product once you input product.
The website communicates with the database to see if it has it.
Then the database responds back.
And all of that is done with the help of Ezekial language and Eskdale queries.
But as usual, user input might not be well filtered and we might be able to inject ESKIL code there
and send our own ESKIL queries to the database.
Maybe on that website, there are online accounts and their passwords are stored in a database.
If we were to find that SQL injection on a website like that, we could potentially extract usernames
and passwords of all of the accounts through that ESKIL injection.
This is an example of how an inquiry could look like it is very similar to English language, and what
this statement essentially does is it selects some type of element from a table where some condition
is fulfilled and table is just a part of database.
Databases are consisted of tables and columns.
Now, I would be real right here.
If you're encountering SQL injection for the first time or ask your language for the first time, you
might find this a little bit hard.
However, through practice, this will become easier and easier.
Here we can see an example of how a real world Eskil query could look like.
Here, books are our table from the database, it is our condition, and this star sign indicates that
we want to extract everything usually in programming, world star sign means everything.
Great, now that we know behind the scenes of how an injection works, let's try to perform one on our
TBWA page.
So let's go right here.
Log in, as usual, to our TBWA Page.
And let's first select a security to allow and navigate to the Ezekial injection.
Now, you might notice that we also have Eskil injection blind, and this is something that we are going
to talk about later on.
For now, let's just focus on this ESKIL injection tap.
So what do we have right here?
We have something called user ID and usually we would input something like a number right here.
So let's give it a try.
For example, input number one and click on Submit.
Well, it will tell me that the idea of one is a user with the first name admin and surname admin and
that user has ID want what if we type two, for example, we click on Submit.
Well, we got a user ID to his name is Gordon and his last name is Brown.
And we can go for each and every number if we want.
For example, the ID five has first name Bob and last name Smith.
But to search for the Eskild injection, what we can do is we can type some special characters and that
might throw an error if there is an injection, for example, if I type apostrophe or a single quote
and I click on Submit.
People throw me this error, it will say you have an error in your Ezekial syntax, check the manual
that corresponds to your MySQL server version for the right syntax to use near line one.
And this already is an indication that we have Eskil injection bug since it interpreted our apostrophe
as a part of Ezekial syntax.
So for now, we know that there is an error because we got the error syntax.
But before we continue, let's first explain why does this give an error?
Why using a single quote gives us an error?
Well, let me show you like this, if I open terminal.
Let's just go and find a program that will allow us to write text and here we got some text editor under
the usual applications.
I'm going to open that and I'm going to enlarge it just so we can type something right here.
And now that we open this, let's explain why apostrophe gives an error in Eskil syntax.
But as we already mentioned in our slides, usually we will have an Ezekial syntax or an Eskil query
that will look something like this.
So select and then something from a certain table where some condition is fulfilled.
And for our page right here, if I go back, since we have user I.D., first names and last names,
it could possibly look something like this.
So select name, comma, surname from the table that could be named something like accounts if we don't
know that yet, where ID equals and then the ID number goes between single quotes.
So this could possibly be our Ezekial query that we sent to the database and then the database retrieves
the user under the ID to.
But what happens when we type apostrophe is instead of these two and instead of it filtering the apostrophe,
it just writes it between these two single quotes and then we get three single quotes, the opening
single quote, and then our single quote, reinjected becomes the closing single quote.
And then the third one is the single quote that's hanging.
It doesn't belong to anything.
Therefore, the Eskil throws an error.
It has one single quote more than it should have.
And whenever that happens, you got an injection bug.
And this is also called the error based ESKIL injection, because it throws us an error.
On the other hand, we got the blindest kill injection that doesn't throw an error.
So there are some other methods that we must use for that one in order to figure out whether it exists.
Now that we know that there is an ESKIL injection, what we can do is we can type some other statements
as well.
For example, we can select the ID number two and then close the single quote inside of that Tasco query.
And we can type some logical statements, such as, for example, and one equals one.
And keep in mind that this right here, if I copied and write it down.
Has single quotes between the numbers, and it doesn't have the single quote at the end, because inside
of our query we already have a single quote at the end of this single quote will cover the last part
of this one.
And this first quote will cover the first part of this, too.
So essentially, once added to our Ask Your query, it would look something like this.
Instead of this single quote, we would have this and you can see these opening and closing single quote
fulfills our statement.
Let's give it a try and run this and we'll just get the information about user under the Editta.
And that is because our statement is correct.
So we select the user Editta and we say do that in case one is equal to one and one is equal to one.
So there are no problems such as the user name.
But if we were to type the same comment, just change one equals two and click on submit, we wouldn't
get any output right here.
That is because one is not equal to two.
Therefore it won't print the user under the ID to.
That could be another sign that there is an Ezekial injection now that we know for sure that there is
an injection, if we can try some other comments, such as, for example, this one.
So if you go down here and type two single quote, and this is just us selecting the ID number two and
then use a statement called Order by one and add dash, dash and space and single quote at the end.
So let's explain this comment.
The reason we have this dash dash space and then single quote is because that is referred to as a comment.
This dash dash is a comment.
And we must add this at the end of our statement, at the end of our query, because otherwise it would
throw us an error.
We must have it so we don't get error when running our ESKIL comments and ordered by one will just check
whether there is column one.
And we are going to do that for two for three as well.
And we're going to see how many columns do we have.
So if I copied this.
And go back to here based this click on Submit.
We'll get an output first name Gordon and surname Brown, that means this is a valid statement.
Let's try with order by two.
So just change from one to two and click on Submit.
And this is also by the statement because we get the first name and surname.
And if we try number three and click on submit.
Well, there is an unknown column three in order class, and that's how we know that we have to count.
Now, let's see what those two columns are.
If I go and type this comment and I'm going to type it right here, first two as our ID and then Unión,
select one and two.
And let's not forget our comment at the end by specifying Dash Dash and then saying quote, If a copy
this.
And they paste it right here, click on Submit.
OK, so we get this output right here, the first name for the Editta and we get the first name one
and surname two.
Now that we know that we have two columns and that we have an injection vulnerability, we're going
to start extracting data.
So we know that we have to output fields, the first name and the surname field, so we're going to
try to extract the database name and the user of the database.
To do that, we can type the command to to select the user ID and then union select and we're going
to type database open and close brackets and comma user open close brackets.
At the end we add our comment with a single vote and here we are specifying the functions called database
and user.
These two functions are already defined in my school.
So let's copy this comment just to see the name of the database and the name of the user and type it
right here.
And we get the first name which will store the database name, which is W A and the surname or the user,
which is going to be viewed at localhost.
Now that we know this, we can try to track the list of the databases by injecting the following comment.
So after this, we once again start with two and then you select these select statements.
You can also type in capital letters.
It doesn't really matter.
You can type capital or lowercase letters.
What matters is that you type the correct command syntax.
So right now we are going to call for Schimmer underscore name, comma to from information underscore.
And let me just.
And this so the entire command can fit to deal from information, underscore Cima.
Dot, Shmita, Dash, dash, and then close single quote.
OK, so let's just go with this and see what do we get with this comment?
If I copy, go to my page and paste it right here.
Well, we get quite a few results back and we essentially get different databases outputted right here.
We got our TBWA database, we got Mathus per database, MySQL database was spent.
And since we are doing this all inside of the WPA application on our anticipatable, we would most likely
be interested in this D.V. a result.
So let's try to extract even more from it.
We can use the following comment, which is I did, too, and then union select table, underscore name,
comma, kill from information on discourse cima.
Not tables might be wondering what even art is, and this is just regular syntax for the language.
These are just something that you will get used to over time once we type from information shemar that
tables where the table on this kortchmar is going to be equal to the one that we want.
And in our case, that is divi.
So we can just type equal open single quote w a close single quote and then our comment dash dash quote.
Let's go, P..
Entire command copied and pasted right here.
Now, I'm not sure if I copied entire comments, I'm just going to go back and add what's missing,
which is two and then single quote, and then you click on submit.
And here is the output.
So with this comment, we sent a query where we requested names of all the tables inside the W8 database.
We got two results, which is guestbook and users.
And this users right here could be interesting for us.
So let's dive deep into it.
We want to extract columns inside of this user's table.
We can do that by injecting this comment right here.
So let me just make a few spaces and type next command, which we, as usual, start with two and then
apostrophe union.
Select and now we're selecting columns, so we are going to type instead of table name.
We're going to type column, underscore name, comma, column, underscore type from information on
discourse, cima dot columns remembering the last command we used dot tables.
Now we are using dot columns because we are furthermore diving into our database and we need a condition
at the end.
So we're table underscore cima is going to be equal to D.V. w a and table underscore name equals users.
So remember we got two results right here and we want to go with the users one first, because that
looks more interesting to us than this guest book table.
OK, so let's go to this comment and now I'm going to copy the entire comment.
So select copy and paste right here.
And click on Submit.
And again, we get a lot of results here they are.
Can you guess which one out of all of these columns are most interesting to us, if you guessed the
password one?
Well, you guessed right, but we also want to extract other columns as well, such as usernames, which
we get right here, such as first names, last names, IDs as well, and all of that we want to extract.
To do this, we will need to use the concat function because we only have two fields available to input
our result.
So we must concat a few results in one field and the rest of the results in the other field.
We can concat, for example, user ID, first name and last name in the first name field, and we can
conquer the usernames and passwords in the surname field.
So let's see how that combined would look like.
If I go back and add a few more spaces, let's type two and then apostrophe union select and then use
the concat function to concat multiple fields into one.
And we can do that by specifying which fields we want inside of this function.
Let's type user underscore ID as a first field comma and we are going to separate them with two dots.
So comma and then first underscore name, which is going to be our second field comma.
Let's use again two.
That's two separate that also from the last name.
And these are the three fields that we are going to get into first result.
Then after it we want to type comma and concat the usernames and passwords into.
Second result.
So let's put it like this password and at the end specify from where are we extracting all of this?
And in our case, since our database is called WPE, we're also accessing the user's table.
So we must type it like this.
So extract all of this from w a dot user's.
Add the comment at the end.
And let's copy all of this.
Well, here it is, here is all of the information about all of the users from this database in the
first name field, we get the user I.D. followed by the first name, followed by the last name.
And in the surname field, we get the username and password.
So we successfully performed ESKIL injection and we extracted all of the information about all of the
users inside of their database.
But you will notice that passwords are rather strange, right?
This is because they are Hashd.
Usually websites store hash value of passwords inside their database for security reasons, since even
if something like an injection happened and someone managed to extract the entire database, they wouldn't
get passwords in plain text, but rather as hash value that they need to run a dictionary attack on
in order to find it in plain text.
And by looking at them, I would say that this is probably a modified hash.
We can figure this out by copying one of these passwords.
So let's go with this one.
For example, going to Google and just pasting it inside of this search bar.
And we can see most of the results are empty, five and five and five, so we can guess that this is
an empty five hash.
And since this is an easy password, if I click on this link, it will even tell me which password this
empty five hash is.
So it is the password A.B.C. one to three.
So if I go back to this page, we can conclude that Cordin has a password of ABC one, two, three,
because this website showed us what is the string of this hash that we pasted.
We can do that for any other hash as well.
As long as it is a simple password, it should manage to find it online.
If I go and paste this one, for example.
Go right here, click on this website and the five hash for password is this.
So it seems that our empty five hash is a string of password.
So our user called admin has a password that is simply just password, and that is how you extract the
entire database with the ESKIL injection vulnerability.
Now, this is probably the hardest bug that we are going to cover inside the Web application section,
and it might take some time for you to get used to it and to get used to all of this as syntax that
we performed right here.
For example, these database functions, user functions could be known by someone that already knows
Ezekial, since these are already the inbuilt functions and that also stands for all of these syntax
like table name, like information, underscore CIMA that columns and the rest of these comments.
But if you practice it more and more, you will eventually get better at performing ESKIL injection.
OK, great.
So we performed as injection and in the next video we're ready to continue discovering even more bugs
on our TBWA application.
So you better.